47
\$\begingroup\$

This is the robbers' thread. The cops' thread is here.

Your challenge is to crack a cop's submission by finding an input that makes it halt. You don't have to find out why, or all inputs that make it halt if there's more than one, or the input the cop intended, just one input will do.

Once you have cracked a submission, post a link to it in a comment or edit to the cop's post. You can also flag your submission for a mod to edit it in the cop's post. Also, post the input used and a link to the cop's post in an answer in this thread. The robber that cracks the most submissions wins.

Multiple people can post cracks to the same cop submission, as long as they are different.

(If SE converted your duplicate answer to a comment, you may want to vote on this feature request)


Looking for uncracked submissions?

fetch("https://api.stackexchange.com/2.2/questions/135363/answers?order=desc&sort=activity&site=codegolf&filter=!.Fjs-H6J36vlFcdkRGfButLhYEngU&key=kAc8QIHB*IqJDUFcjEF1KA((&pagesize=100").then(x=>x.json()).then(data=>{var res = data.items.filter(i=>!i.body_markdown.toLowerCase().includes("cracked")).map(x=>{const matched = /^ ?##? ?(?:(?:(?:\[|<a href ?= ?".*?">)([^\]]+)(?:\]|<\/a>)(?:[\(\[][a-z0-9/:\.]+[\]\)])?)|([^, ]+)).*[^\d](\d+) ?\[?(?:(?:byte|block|codel)s?)(?:\](?:\(.+\))?)? ?(?:\(?(?!no[nt][ -]competing)\)?)?/gim.exec(x.body_markdown);if(!matched){return;}return {link: x.link, lang: matched[1] || matched[2], owner: x.owner}}).filter(Boolean).forEach(ans=>{var tr = document.createElement("tr");var add = (lang, link)=>{var td = document.createElement("td");var a = document.createElement("a");a.innerText = lang;a.href = link;td.appendChild(a);tr.appendChild(td);};add(ans.lang, ans.link);add(ans.owner.display_name, ans.owner.link);document.querySelector("tbody").appendChild(tr);});});
<html><body><h1>Uncracked Submissions</h1><table><thead><tr><th>Language</th><th>Author</th></tr></thead><tbody></tbody></table></body></html>

\$\endgroup\$
3
  • 2
    \$\begingroup\$ Does different mean different inputs (say, all inputs ending with 2 crack the cop's post - can you different people post different numbers ending in 2?) or different families of inputs, or different types of inputs? \$\endgroup\$
    – Stephen
    Jul 24 '17 at 17:03
  • 1
    \$\begingroup\$ Multiple people can post cracks to the same cop submission... Please define different. \$\endgroup\$
    – Dennis
    Jul 25 '17 at 13:41
  • \$\begingroup\$ @NoOneIsHere codegolf.meta.stackexchange.com/q/13437/58826 \$\endgroup\$
    – user58826
    Jul 25 '17 at 15:26

144 Answers 144

1
2 3 4 5
52
\$\begingroup\$

Malbolge, Doorknob

Try it online (Thanks Dennis!)

Input for Windows: F_⌠1234567890

Input on Linux based system using ISO-8559-1: F_ô1234567890

The heart of how the Malbolge program worked is that it depended on a behavior of the Malbolge interpreter which causes an infinite loop if it encounters any instruction which is not between 33 and 126. The program was constructed such that your input would allow you to modify a single instruction.

I modified the interpreter to dump the program memory state at the beginning of execution and to also produce 'normalized' source code which takes the form of a list of op codes that will be run during the execution of the program. With that information you could (slowly) determine that even though the program took 13 inputs only the 1st and 3rd inputs actually mattered.

Looking through the normalized code and memory dump (and a touch of debugger help) I devised the following:

a = op(input 1, 29524)

b = op(input 3, a)

c = op(486, b)

d = op(c, 37)

e = d/4 + d%3 * 3^9

e must be between 33 and 126

Where op is the so called tritwise "op" that is described in the specification. Using this information you can write a simple program which iterates over the possible inputs (0 to 255) and finds all solutions which meet the above criteria. I had found 2219 possible solutions, some of which will probably not be working solutions (you can't input the required characters). Specifically the above inputs are based on the solution:

(Input 1 = 70, Input 3 = 244)

\$\endgroup\$
10
  • \$\begingroup\$ I don't have the rep to comment cracked on the cops post. Could someone do that for me? \$\endgroup\$
    – KBRON111
    Jul 27 '17 at 2:23
  • 5
    \$\begingroup\$ Welcome to PPCG! Good job! I think with this crack, you'll soon have enough rep :) \$\endgroup\$
    – Stephen
    Jul 27 '17 at 2:33
  • 1
    \$\begingroup\$ I commented across. And yes, excellent work; I was half expecting Malbolge to last the week! \$\endgroup\$
    – Veedrac
    Jul 27 '17 at 2:34
  • 6
    \$\begingroup\$ Nice work! TIO uses UTF-8, but by wrapping it in Bash, your crack can still be verified. tio.run/… You don't seem to need anything but F_ô by the way. \$\endgroup\$
    – Dennis
    Jul 27 '17 at 5:07
  • 1
    \$\begingroup\$ Now I can sleep again \$\endgroup\$ Jul 27 '17 at 12:58
15
\$\begingroup\$

JavaScript (in Browser)

document.all

This is falsy, surprisingly

Edit: why is document.all falsy?

\$\endgroup\$
3
  • 4
    \$\begingroup\$ I'm speechless. \$\endgroup\$
    – Dennis
    Jul 25 '17 at 16:34
  • 3
    \$\begingroup\$ Aahh... javascript, where everything is weird \$\endgroup\$ Jul 25 '17 at 16:36
  • 1
    \$\begingroup\$ Yes! That's the only correct answer here! \$\endgroup\$
    – tsh
    Jul 26 '17 at 1:33
12
\$\begingroup\$

JS (ES6), Juan Tonina

+0,-0

Took a bit of looking in Object.is to find. Basically, +0 === -0 since === checks them as numbers, and 0 is finite, but Object.is sees +0 and -0 as different objects. Very smart cop :)

Try it online!

\$\endgroup\$
2
  • \$\begingroup\$ Ninja got it while I was logging in. Shoot. \$\endgroup\$ Jul 24 '17 at 16:59
  • \$\begingroup\$ Damn, solved faster than the time I spent thinking about the code :D \$\endgroup\$ Jul 24 '17 at 17:02
12
\$\begingroup\$

Python, Siphor

class A:
    i = True
    def __eq__(self, a):
        self.i = not self.i
        return self.i

a = A()
f(a)

We just redefine equality to behave exactly as required to get the program to terminate.

\$\endgroup\$
7
  • \$\begingroup\$ Although I suppose I could have just defined __eq__ to raise... \$\endgroup\$ Jul 24 '17 at 21:35
  • \$\begingroup\$ I was about to submit with just returning 0 :p \$\endgroup\$ Jul 24 '17 at 21:40
  • \$\begingroup\$ @JonathanAllan How does that work? \$\endgroup\$ Jul 24 '17 at 21:41
  • 1
    \$\begingroup\$ Pretty sure just class A:__eq__=lambda s,o:0 and f(A()) does the job. \$\endgroup\$ Jul 24 '17 at 21:41
  • 1
    \$\begingroup\$ Ah yeah need the negation >_< \$\endgroup\$ Jul 24 '17 at 21:42
8
\$\begingroup\$

Braingolf

-1

Any number less than 0 works.

Try it Online!

\$\endgroup\$
0
8
\$\begingroup\$

PHP, Sisyphus

(-0[0)> deal with it=1

The parse_str function changes the spaces and other characters to underscores. If you put a [ used for Array delimiter without closing, it changes it to an underscore but has the effect of not translating the following spaces (I don't know why).

Try it online!

\$\endgroup\$
1
  • \$\begingroup\$ WTF?! That is insane... \$\endgroup\$
    – Veedrac
    Jul 25 '17 at 16:49
6
\$\begingroup\$

JavaScript (Node.js), Adnan

[] and [] seem to work. I tried a bunch of them including null, undefined, NaN...

[] >= [] && [] <= [] && [] != [] evaluates to true.

Moral of the story: JavaScript is weird.

Try it online!

\$\endgroup\$
2
  • \$\begingroup\$ Yep, arrays are just objects. \$\endgroup\$
    – user58826
    Jul 24 '17 at 18:05
  • \$\begingroup\$ And objects are cast to strings for these types of comparisons. \$\endgroup\$ Jul 24 '17 at 20:49
6
\$\begingroup\$

JavaScript (ES7), Arnauld

Standard

"8e7" is solution

var crack_me = (x=0)=>{for(;~x/x.length**3!=-2962963;);}

var key = "8e7"

crack_me(key)
console.log("stopped :)")

Hack

No need to calculate this number, we can redefine length property

This sets ~x/x.length**3!=-2962963 to false

var crack_me = (x=0)=>{for(;~x/x.length**3!=-2962963;);}

var key = {toString:()=>"2962962",length:"1"}

crack_me(key)
console.log("stopped :)")

Operators priority

~ bitwise not is first

** exponentiation second

/ division third

\$\endgroup\$
5
\$\begingroup\$

Bash, Veedrac

LD_TRACE_LOADED_OBJECTS

Try it online!

From the ld.so(8) manpage:

LD_TRACE_LOADED_OBJECTS

If set (to any value), causes the program to list its dynamic dependencies, as if run by ldd(1), instead of running normally.

\$\endgroup\$
2
  • \$\begingroup\$ I thought this would last longer! Excellent work. \$\endgroup\$
    – Veedrac
    Jul 25 '17 at 13:09
  • 1
    \$\begingroup\$ @Veedrac: I guess since you specified bash, it's unlikely that you'd find a statically-linked (e.g. busybox?) /bin/yes, but that is possible, in which case this env var would be ignored. \$\endgroup\$ Jul 27 '17 at 10:35
5
\$\begingroup\$

Mathematica, JungHwan Min

Unevaluated@Throw@"hammertime"

No clue whether this is the intended solution, but it passes in an expression that doesn't get evaluated until it's referenced as # inside the function, which will cause it turn return from the function immediately without doing any further evaluation. You can see that the function is actually called (instead of just throwing the exception before even invoking the function) by changing the function to:

#0[Print@"stop";#;$IterationLimit=∞]&

Which will indeed print the stop before throwing the error.

\$\endgroup\$
1
  • \$\begingroup\$ Bingo! (I was actually going for Unevaluated[Abort[]], but same thing.) \$\endgroup\$ Jul 25 '17 at 15:29
5
\$\begingroup\$

R, Jarko Dubbeldam

function(x)if(is.list(x))return(1)

First time contributing anything, so do call out any mistakes I've made in format.

Pretty sure this is valid. Just a rewrapping of is.list(), right?

\$\endgroup\$
3
  • \$\begingroup\$ Incidentally, I don't have the rep to comment on the original so a hand would be appreciated if it's valid. \$\endgroup\$ Jul 27 '17 at 12:59
  • \$\begingroup\$ Commented for you. \$\endgroup\$ Jul 27 '17 at 13:02
  • \$\begingroup\$ Not the intended solution, but works. Good job. \$\endgroup\$
    – JAD
    Jul 27 '17 at 13:04
4
\$\begingroup\$

Retina, PunPun1000

11111

Try it online!

Any input with n 1s where the sum of the divisors of n+1 is equal to n+1 should work.

\$\endgroup\$
1
  • \$\begingroup\$ Nice to see someone get the intended solution \$\endgroup\$
    – PunPun1000
    Jul 24 '17 at 16:52
4
\$\begingroup\$

Node.js, Adnan

{} and {} or any 2 objects are the two inputs. I don't even understand how this works.

Here's JS's amazing object compare logics:

console.log({} == {});
console.log({} === {});
console.log({} > {});
console.log({} < {});
console.log(!!{});

console.log({} >= {});
console.log({} <= {});

\$\endgroup\$
1
  • \$\begingroup\$ Yup, that was the intended solution :) \$\endgroup\$
    – Adnan
    Jul 24 '17 at 18:04
4
\$\begingroup\$

Ruby

exit

without newline. 3.send('exit') surely isn't equal to 5, but it executes Kernel#exit:

Initiates the termination of the Ruby script by raising the SystemExit exception

It's possible to call exit on 3 because:

The Kernel module is included by class Object, so its methods are available in every Ruby object [as private methods].

abort also works:

Terminate execution immediately, effectively by calling Kernel.exit(false). If msg is given, it is written to STDERR prior to terminating.

\$\endgroup\$
4
\$\begingroup\$

JavaScript (Node.js), programmer5000

Already cracked, but mine is slightly different :) Don't have enough rep to comment over in the cops. Also feel free to edit to fix formatting, my first post here.

Mainly I set __proto__ equal to a function that throws. Taken from looking at the Mozilla page for proto. (Sorry, low rep, can't post a link.)

x = {}
let No = function () { throw 'halted' }
x.__proto__ = new No()
f = x=>{while(x.__proto__);}

Try it online!

EDIT: Got some rep, so here's the link: Mozilla __proto__

\$\endgroup\$
3
  • \$\begingroup\$ I commented on the cop for you. \$\endgroup\$
    – Stephen
    Jul 24 '17 at 23:03
  • 1
    \$\begingroup\$ Thanks! Also thanks all for the ups, guess I can comment now! \$\endgroup\$ Jul 24 '17 at 23:15
  • 1
    \$\begingroup\$ Welcome to PPCG :D \$\endgroup\$ Jul 24 '17 at 23:22
4
\$\begingroup\$

Bash, Sisyphus

kill 0

Fortunately, kill is a shell builtin.

Try it online!

\$\endgroup\$
4
\$\begingroup\$

Javascript, programmer5000

Max string length

Uses a string with a length one less than what your engine supports. When adding "h" to this string, an error is thrown. Try it online!

function getAlmostMaxLenStr() {
  var prevBases = [];
  var base = "a";
  try {
    while(true) {
      prevBases.push(base);
      base += base;
    }
  } catch(e) {}
  for (var i = prevBases.length-1; i>=0; --i) {
    try {
      base += prevBases[i];
    } catch (e) {}
  }
  return base;
}
f(getAlmostMaxLenStr());

Cross-origin block

Heavily inspired by the answer from @jadkik94, but works everywhere. Creates a cross-origin iframe, then passes the .contentWindow of said iframe. This fails when the function tries to use the value due to cross-origin safety.

let f=x=>{
  try {
    console.log(x+"h"); // we don't want to lock up your browser, do we ;)
  } catch (e) { console.log("Halted!\n",e); }
}
let iframe=document.createElement("iframe");
const url = location.host.indexOf("google") === -1 ? "https://google.com" : "https://stackexchange.com";
iframe.src=url;
iframe.onload=a=>f(iframe.contentWindow);
document.body.appendChild(iframe);

Primitive value

Variant of the .toString() answers - this just uses toPrimitive instead. It returns an object as the primitive value, which Javascript doesn't know how to handle (so it throws an error). Try it online!

f({
  [Symbol.toPrimitive](){return {}}
});
\$\endgroup\$
1
  • \$\begingroup\$ Nice job, but still not intended solution! Very clever! \$\endgroup\$
    – user58826
    Jul 25 '17 at 11:30
3
\$\begingroup\$

JavaScript (Babel Node), Conor O'Brien

(Repost, accidentally put in cops.) Not sure what was intended but positive decimals that aren't enormous all seem to work.

Also I guess I still can't comment in Cops.

f(0.1)
console.log('done')

Try it online!

\$\endgroup\$
1
  • \$\begingroup\$ Forgot about that as well, good one. \$\endgroup\$ Jul 24 '17 at 23:48
3
\$\begingroup\$

Javascript (NOT node.js), programmer5000

This can't be added because it creates an object that has no toString because a new Set does not inherent prototypes from from Object.

input:

new Set()

Try it online!

\$\endgroup\$
4
  • \$\begingroup\$ This was probably the intended solution, I'll keep that in the bag of my head from now on :P \$\endgroup\$
    – Stephen
    Jul 24 '17 at 20:29
  • \$\begingroup\$ Sorry this doesn't seem to work for me? Try it online! \$\endgroup\$ Jul 25 '17 at 1:04
  • \$\begingroup\$ @HaumedRahmani added a try online button. I used spider monkey, not babel. \$\endgroup\$ Jul 25 '17 at 1:40
  • \$\begingroup\$ Not the intended solution, but nice job! \$\endgroup\$
    – user58826
    Jul 25 '17 at 1:49
3
\$\begingroup\$

Bash 4.2, Dennis

PATH=1

Clearly not the intended solution, because it works on newer bash as well.

Try it online.

\$\endgroup\$
3
\$\begingroup\$

Octave, Stewie Griffin

Input: exit

Reasoning: input evalutes whatever is input. exit exits the program.

Try it online!

\$\endgroup\$
3
\$\begingroup\$

Python 2, Foon

__import__("os")._exit(0)

What it says on the tin, basically.

Try it online.

\$\endgroup\$
5
  • \$\begingroup\$ Interestingly enough, on TIO this times out for me; under Windows (specifically with winpty python inputbad.py and pasting in the line), it does exit as desired... and yeah, not surprisingly my schtict was exploiting the "input under Python 2 does eval under the hood" bit \$\endgroup\$
    – Foon
    Jul 25 '17 at 11:01
  • \$\begingroup\$ @Foon Hmm, it's working fine on TIO for me. See link in answer. \$\endgroup\$
    – Veedrac
    Jul 25 '17 at 11:18
  • \$\begingroup\$ Weird... I must have hit play and then typed input on my TIO link and not realized it \$\endgroup\$
    – Foon
    Jul 25 '17 at 13:42
  • \$\begingroup\$ I'm pretty sure this cracks every python submission.. \$\endgroup\$
    – enderland
    Jul 26 '17 at 3:13
  • \$\begingroup\$ @enderland Only if they evaluate your input, which most of them don't. \$\endgroup\$
    – Veedrac
    Jul 26 '17 at 3:26
3
\$\begingroup\$

Python 3 (CPython), Veedrac

a=('',(type,),{})
X=type(*a)(*a)
X.__class__=X

Try it online!

\$\endgroup\$
3
\$\begingroup\$

Python 3, Siphor

This was fun. We need to make the type(x) != str check pass, so we need to control the return value of type(). We have to override the __class__ attribute and replace it with a custom object, that extends type, which has the __ne__ method replaced by one that always returns false. This makes it pass the type check, but the search will fail because o is not a str.

class m(type):
    def __ne__(a,b):
        return False
class c:pass
o=c()
o.__class__=m("",(c,),{})
f(o)
\$\endgroup\$
1
  • \$\begingroup\$ Welcome to the site! :) \$\endgroup\$
    – DJMcMayhem
    Jul 25 '17 at 21:01
3
\$\begingroup\$

R, Jarko Dubbeldam

Just an invalid regex.

"["

Try it online.

\$\endgroup\$
3
\$\begingroup\$

Python, Siphor

f('t=False')

Crashes due to an UnboundLocalError. I think this is hapening because my t=False overrides the higher-scoped t with the local t, but it's not set at the time of the loop, causing the crash.

TIO

\$\endgroup\$
1
  • \$\begingroup\$ This seems so easy, good job. \$\endgroup\$ Jul 27 '17 at 8:18
3
\$\begingroup\$

Commodore 64 Basic, Mark

If I understood this correctly (and it's entirely plausible I have not), you just need to overflow the floating point variable.

9999999999999999999999999999999999999999999999999999999999999999.9
\$\endgroup\$
1
  • 3
    \$\begingroup\$ You can use scientific notation for a shorter crack. A simple 1E50 will do just as well, and is easier to type. \$\endgroup\$
    – Mark
    Jul 25 '17 at 22:16
3
\$\begingroup\$

Bash 4.2, Dennis

-9223372036854775808/-1

Why though, Dennis? y u do dis?

\$\endgroup\$
4
  • 1
    \$\begingroup\$ Well done. I had 2**63%-1, which results in the same operation. \$\endgroup\$
    – Dennis
    Jul 26 '17 at 2:49
  • \$\begingroup\$ I assume this is a parsing or evaluation bug of some sort? What exactly causes it to fail? \$\endgroup\$ Jul 26 '17 at 7:51
  • 1
    \$\begingroup\$ @RobertFraser It overflows! They're stored in small registers and the division generates a SIGFPE. \$\endgroup\$
    – Veedrac
    Jul 26 '17 at 11:08
  • 2
    \$\begingroup\$ It's somewhat ironic that (on most platforms, including x86) unless you on purpose unmask FP exceptions, the only thing that will normally raise SIGFPE is an integer division exception. (by zero, or overflow). But POSIX requires integer division to raise SIGFPE if it raises any signal at all: stackoverflow.com/questions/37262572/… \$\endgroup\$ Jul 27 '17 at 10:39
3
\$\begingroup\$

C#, TheLethalCoder

System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]

Or any other nullable class.

\$\endgroup\$
3
\$\begingroup\$

C#, TheLethalCoder

new char[0]

string.Empty ("") is always interned. Therefore, an empty array or null will work.

\$\endgroup\$
1
2 3 4 5

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy